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L Transmitted herewith, is the APPEAL BRIEF in this application, with respect to the Notice of 
Appeal filed on September 21 , 2005. 
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Pursuant to 37 C.F.R. § 41 .20(b)(2), the fee for filing the Appeal Brief is: 



other than a small entity 



$500.00 



Appeal Brief fee due 



S500.00 



4. EXTENSION OF TERM 

The proceedings herein are for a patent application and the provisions of 37 C.F.R. § 1.136 apply. 

Applicant believes that no extension of time is necessary however if the examiner feels that fees are 
due in accordance with the filing of this paper, the examiner is authorized to charge such fees to 
deposit account 50-1351 order no. (NAI1P014). 

5. TOTAL FEE DUE 
The total fee due is: 



6. FEE PAYMENT 

Authorization is hereby made to charge the amount of $500.00 to Deposit Account No. 50-1351 
(Order No. NAI1P014). 

A duplicate of this transmittal is attached. 

7. FEE DEFICIENCY 
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charge Deposit Account No. 50-135 1 (Order No. NAI1P014)./ 
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TOTAL FEE DUE 
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RECEIVED 

CENTRAL FAX CENTER 



DEC 1 2 2005 



PATENT 



IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 



In re the application of 



Barton et al. 



Group Art Unit: 2137 



Application No. 09/916,929 



Ex: Schubert, Kevin R- 



Filed: 1x11x26,2001 



Date: December 12, 2005 



For: ANTI-VIRUS SCANNING CO-PROCESSOR] 



Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

ATTENTION: Board of Patent Appeals and Interferences 



This brief is in furtherance of the Notice of Appeal, filed in tins case on September 21, 2005. 

The fees required under § 1.17, and any required petition for extension of time for filing this 
brief and fees therefor, are dealt with in the accompanying TRANSMITTAL OF APPEAL 
BRIEF. 

This brief contains these items under the following headings, and in the order set forth below (37 



C.F.R. §41.37(c)(i)): 

I REAL PARTY IN INTEREST 

II RELATED APPEALS AND INTERFERENCES 
IE STATUS OF CLAIMS 

IV STATUS OF AMENDMENTS 

12/14/2005 WflBDELRl 00000042 501351 09916929 
01 FC:1402 500.00 DA 
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V SUMMARY OF CLAIMED SUBJECT MATTER 

VI GROUNDS OF REJECTION PRESENTED FOR REVIEW 

VII ARGUMENTS 

VHI APPENDIX OF CLAIMS INVOLVED IN THE APPEAL 

IX APPENDIX LISTING ANY EVIDENCE RELIED ON BY THE APPELLANT IN 
THE APPEAL 

The final page of this brief bears the practitioner's signature. 
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I REAL PARTY IN INTEREST (37 CF.R. § 4l.37(c)(l)(i)) 

The real party in interest in this appeal is McAfee, Inc. 
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H RELATED APPEALS AND INTERFERENCES (37 C.F.R. § 41.37(c) (l)(iQ) 

With respect to other prior or pending appeals, interferences, or related judicial proceedings that 
will directly affect, or be directly affected by, or have a bearing on the Board's decision in the 
pending appeal, there are no other such appeals, interferences, or related judicial proceedings. 

Since no such proceedings exist, no Related Proceedings Appendix is appended hereto. 



.4. 



PAGE 9/31 * RCVD AT 12112/2005 6:16:28 PM [Eastern Standard Time] ' 8VR:U8PTO€FXRF-6/30 * DNI&2738300 1 CSID:4089714660 * DURATION (mm-ss):0M6 



DEC. 1 2. 2005 3:27PM Z I L KA-K0TA8, PC 



NO. 1271 P. 10 



IH STATUS OF CLAIMS (37 C.F.R. § 41.37(c) (l)(iii)) 

A. TOTAL NUMBER OF CLAIMS IN APPLICATION 
Claims in the application are: 1-13, 17-29 and 33-44 

B. STATUS OF ALL THE CLAIMS IN APPLICATION 

1 . Claims withdrawn from consideration: None 

2. Claims pending: 1-13, 17-29 and 33-44 

3. Claims allowed: None 

4. Claims rejected: 1-13, 17-29 and 33-44 

C. CLAIMS ON APPEAL 

The claims on appeal are: 1-13, 17-29 and 33-44 

See additional status information in the Appendix of Claims. 
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IV STATUS OF AMENDMENTS (37 C.F.R. § 41.37(c)(l)(iv)) 

As to the status of any amendment filed subsequent to final rejection, there are no such 
amendments after final. 
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V SUMMARY OF CLAIMED SUBJECT MATTER (37 C.F.R. § 41 J7(c)(l)(v)) 

With respect to a summary of Claim 1 et aL, as shown in Figures 5 and 6, a technique is provided 
for scanning data. In use, scanning control logic is executed utilizing a central processing unit 
(e.g. item 502 of Figure 5) and the data is indicated to a scanning co-processor coupled to the 
central processing unit so that the data is scanned by the scanning co-processor under the control 
of the scanning control logic (e.g. item 510/514 of Figure 5). Results from the scanning co- 
processor are waited for (e.g. decision 516 of Figure 5) and additional logic is executed utilizing 
the central processing unit while waiting for the results from the scanning co-processor (e.g. item 
5 14 of Figure 5). In addition, an event is initiated based on the results from the scanning co- 
processor (e.g. item 518 of Figure 5). The scanning co-processor is also under the control of the 
central processing unit via the execution of the scanning control logic by the central processing 
unit. Furthermore, it is determined whether the data meets a predetermined criteria, where the 
criteria is based on a type of a file associated with the data (e.g. item 506 of Figure 5) and the 
data is sent to the scanning co-processor if it is deterrnined that the data meets the predetermined 
criteria (e.g. operation 508 of Figure 5). Still yet, additional data to be scanned by the scanning 
co-processor is queued while waiting for the results from the scanning co-processor (e.g. item 
610 of Figure 6). Note page 9, line 10-page 11, line 18, for example. 

With respect to a summary of Claims 34 et al., the above summary is incorporated in full. In 
addition, as shown in Figure 6, scanning information is collected from memory on the scanning 
co-processor (e.g. item 602 of Figure 6) and the data is scanned with the scanning co-processor 
utilizing the scanning information under the control of the scanning control logic (e.g. item 604 
of Figure 6). Note page 11, lines 4-9, for example. 
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VI GROUNDS OF REJECTION PRESENTED FOR REVIEW (37 C.F.R. § 
41.37(c)(l)(vi)) 

Following, under each issue listed, is a concise statement setting forth the corresponding ground 
of rejection. 

Issue #1: The Examiner has rejected Claims 1-2, 4-7, 9-13, 17-18, 20-23, 25-29, 33-35, 38-40, 
42 and 44 under 35 U.S.C. 102(e) as being anticipated by Grupe et al., U.S. Patent Application 
Publication No. 2002/0194212. 

Issue #2: The Examiner has rejected Claims 3, 8, 19, 24, 36, 41 and 43 under 35 U.S.C. 103(a) 
as being unpatentable over Grupe et al., U.S. Patent Application Publication No. 2002/0194212, 
in view of Zuta, International Publication No. WO 98/45778. 

Issue #3: The Examiner has rejected Claim 37 under 35 U.S.C. 103(a) as being unpatentable 
over Grupe et al., U.S. Patent Application Publication No. 2002/0194212, in view of Snavely 
(Snavely, Allan; Tullsen, Dean. Symbiotic Jobscheduling for a Simultaneous Multithreading 
Processor. Published in the Proceedings of ASPLOS IX. November 2000). 
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VH ARGUMENTS (37 CF,R* § 41.37(c)(l)(vii)) 



Issue #1: 

The Examiner has rejected Claims 1-2, 4-7, 9-13, 17-18, 20-23, 25-29, 33-35, 38-40, 42 and 44 
under 35 U.S.C. 102(e) as being anticipated by Grupe et aL, U.S. Patent Application Publication 
No. 2002/0194212, 

Group #1: Claims I 4-7, 9-11, 13, 17, 20-23, 25-2? \ 29, 33, 39, 40, 42 and 44 



The Examiner has relied on the following excerpts to make a prior art showing of appellant's 
claimed "executing additional logic utilizing the central processing unit while waiting for the 
results from the scanning co-processor." 



u Viewed from one aspect the present invention provides a computer 
program product comprising a computer program operable to control a 
scanning computer to produce a log file identifying computer data from 
a source computer having specified content, said computer program 
comprising: scanning logic operable to scan computer data transferred 
from said source computer to said scanning computer and to identify one 
or more portions of said computer data having one or more predetermined 
characteristics indicative of said computer data having said specified 
content; and log generating logic operable to write details of said 
identified portions to a log file." [0003] 

"The invention recognises the above problem of scans of computer data 
that take so long that a complete scan of the data cannot be performed 
during slack time, such as overnight or during the weekend. To address 
this problem embodiments of the invention transfer data to be scanned 
from a source computer to a scanning computer, The scanning computer 
then scans the data and creates a log file identifying portions of the 
data that have predetermined characteristics indicating a particular 
specified content. This enables the source computer to re scan or 
otherwise selectively proceaa the data identified in the log file, 
which considerably reduces the processing time of the source computer 
needed for a scan." [0009] (emphasis added) 

Appellant respectfully asserts that the above excerpts simply disclose a "scanning computer 
[that] scans the data and creates a log file" and a source computer that subsequently "rescan[s] or 
otherwise selectively process[es] the data identified in the log file." Thus, the source computer 
cannot take any action until it receives the log file from the scanning computer, which is clearly 
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distinguished from appellant's claimed "executing additional logic utilizing the ce ntral 
nrocessing unit while waiting for the results from the s canning 00-010068801" (emphasis added). 

In addition, the Examiner has relied on the above excerpts to meet appellant's claimed "wherein 
the scanning co-processor is under the control of the central processing unit via the execution of 
the scanning control logic by the central processing unit" Grape, however, teaches a "computer 
program product comprising a computer program operable to control a scanning computer," and 
the Examiner has also admitted that "[t]he scanning control logic is maintained in the scanning 
co-processor computers)." Both the prior art and the Examiner's statements clearly teach away 
from appellant's claim language since appellant claims "execution of the scanning control logic 
bv the central processing unit " and NOT by the scanning co-processor (emphasis added). 

Furthermore, the Examiner has relied on paragraph [0009] as cited above to make a prior art 
showing of appellant's claimed "wherein additional data to be scanned by the scanning co- 
processor is queued while waiting for the results from the scanning co-processor." In doing so, 
the Examiner has stated that "[i]t is inherent that the data is not all processed at the same exact 
time but is rather processed in a queue on the scanning computer where additional data to be 
scanned is processed after the results of the first data are processed." Appellant respectfully 
disagrees with the Examiners assertion. Specifically, appellant's claimed "wherein additional 
data to be scanned by the scanning co-processor is queued" is not inherent in the context of 
appellant's remaining claim language. 

The Examiner is reminded that a claim is anticipated only if each and every element as set forth 
in the claim is found, either expressly or inherently described in a single prior art reference. 
Verdegaal Bros. v. Union Oil Co. Of California, 814 F.2d 628, 631, 2 USPQ2d 1051, 1053 (Fed. 
Cir. 1987). Moreover, the identical invention must be shown in as complete detail as contained 
in the claim. Richardson v. Suzuki Motor Co. 868 F.2d 1226, 1236, 9USPQ2d 1913, 1920 (Fed. 
Cir, 1989). The elements must be arranged as required by the claim. 

This criterion has simply not been met by the Grupe reference, especially in view of the 
arguments made hereinabove. 
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Group #2: Claims 2 and 18 

The Examiner has relied on paragraph [0015] to make a prior art showing of appellant's claimed 
processing the data utilizing the central processing unit upon the receipt of favorable results 
from the scanning co-processor including a situation where malicious code is not detected." 
Appellant respectfully asserts that such except only teaches "further processing tasks upon at 
least said data identified in said log file as having said predetermined characteristics" (emphasis 
added). Thus, Grupe only teaches processing a log file if it has the predetermined characteristics 
indicative of the file having some specified content, and not when "malicious code is not 
detected" as claimed by appellant (emphasis added). 

Again, appellant respectfully asserts that appellant's specific claim language is not anticipated by 
the Grupe reference since all of appellant's claim limitations have not been met by the Grupe 
reference, as noted above. 

Group U3: Claims 12 and 28 

The Examiner has rejected appellant's claim language by stating that "[i]t is inherent that the 
virus signatures are stored in order for the scanning co-processor to detect that a virus is 
present." Appellant respectfully asserts that virus signatures are not inherent in virus scanning. 

Again, appellant respectfully asserts that appellant's specific claim language is not anticipated by 
the Grupe reference since all of appellant's claim limitations have not been met by the Grupe 
reference, as noted above. 

Group #4: Claims 34 and 35 

The Examiner has relied on the following excerpts to make a prior art showing of appellant's 
claimed "executing additional logic utilizing the central processing unit while waiting for the 
results from the scanning co-processor." 
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* Viewed from one aspect the present invention provides a. computer 
program product comprising a computer program operable to control a 
scanning computer to produce a log file identifying computer data from 
a source computer having specified content, said computer program 
comprising: scanning logic operable to scan computer data transferred 
from said source computer to said scanning computer and to identify one 
or more portions of said computer data having one or more predetermined 
characteristics indicative of said computer data having said specified 
content; and log generating logic operable to write details of said 
identified portions to a log file." [0008] 

"The invention recognises the above problem of scans of computer data 
that take so long that a complete scan of the data cannot be performed 
during slack time, such as overnight or during the weekend. To address 
this problem embodiments of the invention transfer data to be scanned 
from a source computer to a scanning computer. The scanning computer 
then scans the data and creates a log file identifying portions of the 
data that have predetermined characteristics indicating a particular 
specified content. Hh±a enables the source computer to re scan or 
otherwise selectively process the data identified in the log file, 
which considerably reduces the processing time of the source computer 
needed for a scan," [0009] (emphasis added) 



Appellant respectfully asserts that the above excerpts simply disclose a "scanning computer 
[that] scans the data and creates a log file" and a source computer that subsequently "rescan[s] or 
otherwise selectively processes] the data identified in the log file." Thus, the source computer 
cannot take any action until it receives the log file from the scanning computer, which is clearly 
distinguished from appellant's claimed "executing additional logic utilizing the central 
processing unit while waiting for the results from the scanning co-processor" (emphasis added). 

La addition, the Examiner has relied on the above excerpts to meet appellant's claimed * Vherein 
the scanning co-processor is under the control of the central processing unit via the execution of 
the scanning control logic by the central processing unit." Grupe, however, teaches a "computer 
program product comprising a computer program operable to control a scanning computer," and 
the Examiner has also admitted that "[t]he scanning control logic is maintained in the scanning 
co-processor computers)/' Both the prior art and the Examiner's statements clearly teach away 
from appellant's claim language since appellant claims "execution of the scanning control logic 
by the central processing unit" and NOT by the scanning co-processor (emphasis added). 
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Furthermore, the Examiner has relied on paragraph [0009] as cited above to make a prior art 
showing of appellant's claimed "wherein additional data to be scanned by the scanning co- 
processor is queued while waiting for the results from the scanning co-processor." In doing so, 
the Examiner has stated that "[i]t is inherent that the data is not all processed at the same exact 
time but is rather processed in a queue on the scanning computer where additional data to be 
scanned is processed after the results of the first data are processed," Appellant respectfully 
disagrees with the Examiners assertion, Specifically, appellant's claimed "wherein additional 
data to be scanned by the scanning co-processor is queued" is not inherent in the context of 
appellant's remaining claim language, 



In addition, the Examiner has relied on the following excerpt to make a prior art showing of 
appellant's claimed "processing the data utilizing the central processing until upon the receipt of 
favorable results from the scanning co-processor including a situation where malicious code is 
not detected." 



tt A further aspect of the present invention provides a computer program 
product comprising a computer program operable to control a source 
computer to scan computer data stored by said source computer to 
identify one or more portions of said computer data having one or more 
predetermined characteristics indicative of said computer data having 
some specified content, said computer program comprising: log reading 
logic operable to control said source computer to read a log file 
written by a scanning computer, said log file identifying portions of 
said computer data having said predetermined characteristics; and 
response logic responsive to said log file and operable to control said 
source computer to perform further processing tasks upon at least said 
data identified in said log file as having said predetermined 
characteristics." [0015] (emphasis added) 

Appellant respectfully asserts that the above excerpt simply discloses "response logic responsive 
to said log file and operable to control said source computer to perform further processing tasks 
upon at least said data identified in said log file as having said predetermined characteristics" 
wherein the "predetermined characteristics [are] indicative of said computer data having some 
specified content." Furthermore, Grupe discloses "any content of data that the user cares to 
specify may be scanned for. . .particularly. . , a computer virus; a worm; a Trojan; and a computer 
file comprising banned content" (see paragraph [001 1]). 
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Thus, Grupe' s "log file" includes data with specified content that is unwanted (e.g. viruses, 
worm, etc.), such that the source computer performs further processing tasks upon the data in the 
log file, Therefore, it seems that Grupe discloses further processing of data that is NOT 
favorable. Appellant, on the other hand, claims processing the data utilizing the central 
processing unit upon receipt of favorable results from the scanning co-p rocessor including a 
situation where malicious code is not detected ." 

Again, appellant respectfully asserts that appellant's specific claim language is not anticipated by 
the Grupe reference since all of appellant's claim limitations have not been met by the Grupe 
reference> as noted above. 

Group #5: Claim 38 

The Examiner has rejected dependent Claim 38 as being met by Grupe's disclosed 
"embodiments of the above invention can be used to detect any content of a file that the user 
specifies" (see paragraph [00361), Appellant respectfully asserts that "wherein the criteria is 
further based on a user" (Claim 38) is simply not taught by "detecting] any content" as taught in 
Grupe. Detecting content of a file does not encompass a user , since a user is not considered 
content in a file . 

Again, appellant respectfully asserts that appellant's specific claim language is not anticipated by 
the Grupe reference since all of appellant's claim limitations have not been met by the Grupe 
reference, as noted above. 

Issue #2: 

The Examiner has rejected Claims 3, 8, 19, 24, 36, 41 and 43 under 35 U.S.C. 103(a) as being 
unpatentable over Grupe et al., U.S. Patent Application Publication No. 2002/0194212, in view 
of Zuta, International Publication No, WO 98/45778. 

Group #1: Claim 3, 19, 36 and 43 
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Appellant respectfully asserts that such claims have not been met by the prior art by virtue of the 
arguments made in Issue #1, Group #1 above. 

Group #2: Claims 8 and 24 

The Examiner has relied on page 19, paragraph 2 in Zuta to make a prior art showing of 
appellant's claimed technique 'Svherein the event is initiated under the control of the scanning 
control logic/' Appellant respectfully asserts that such excerpt in Zuta only generally teaches 
that "the application computer can be immediately stopped if necessary" but not under which 
logic it can be stopped. In particular, Zuta does not specifically disclose that an "event is 
initiated under the control of the scanning control logic" (emphasis added) where the scanning 
control logic is executed utilizing a central processing unit, in the context claimed by appellant. 

Again, appellant respectfully asserts that appellant's specific claim language is not anticipated by 
the Grupe reference since all of appellant's claim limitations have not been met by the Grupe 
reference, as noted above. 

Group #3; Claim 41 

The Examiner has relied on page 24, lines 1-3 in Zuta to make a prior art showing of appellant's 
claimed technique therein the scanning control logic is executed automatically when a 
computer is hooted up " Appellant respectfully asserts that such excerpt merely discloses that at 
power-up "the controller 21 loads known viruses pattern as well as sensitive operations which 
demand further scrutiny," Clearly a viruses pattern and sensitive operations that demand further 
scrutiny do not meet appellant's claimed scanning control logic. 

Again, appellant respectfully asserts that appellant's specific claim language is not anticipated by 
the Grupe reference since all of appellant's claim limitations have not been met by the Grupe 
reference, as noted above. 
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Issue #3: 

The Examiner has rejected Claim 37 under 35 U.S.C. 103(a) as being unpatentable over Grupe et 
al., U.S. Patent Application Publication No. 2002/0194212, in view of Snavely (Snavely, Allan; 
Tullsen, Dean. Symbiotic Jobscheduling for a Simultaneous Multithreading Processor. 
Published in the Proceedinp of ASPLOS IX. November 2000). 

Group #1: Claim 37 

Appellant respectfully asserts that such claims have not been met by the prior art by virtue of the 
arguments made in Issue #1, Group #4 above. 

In view of the remarks set forth hereinabove, all of the independent claims are deemed 
allowable, along with any claims depending therefrom. 
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VIII APPENDIX OF CLAIMS (37 C.F.R. § 4l37(c)(l)(viii)) 

The text of the claims involved in the appeal (along with associated status information) is set 
forth below: 

1 . (Previously Presented) A method for scanning data, comprising: 

a) executing scanning control logic utilizing a central processing unit; 

b) identifying a request related to data at the central processing unit; 

c) indicating the data to a scanning co-processor coupled to the central processing unit so 
that the data is scanned by the scanning co-processor under the control of the scanning 
control logic; 

d) waiting for results from the scanning co-processor; 

e) executing additional logic utilizing the central processing unit while waiting for the 
results from the scanning co-processor; and 

f) initiating an event based on the results from toe scanning co-processor; 

wherein the scanning co-processor is under the control of the central processing unit via 
the execution of the scanning control logic by the central processing unit; 
wherein it is determined whether the data meets a predetermined criteria, where the 
criteria is based on a type of a file associated with the data; 

wherein the data is sent to the scanning co-processor if it is determined that the data 
meets the predetermined criteria; 

wherein additional data to be scanned by the scanning co-processor is queued while 
waiting for the results from the scanning co-processor. 

2. (Previously Presented) The method as recited in claim 1 ? and further comprising 
processing the data utilizing the central processing unit upon the receipt of favorable 
results from the scanning co-processor including a situation where malicious code is not 
detected. 

3. (Original) The method as recited in claim 1, wherein the central processing unit is 
coupled to the scanning co-processor via a bus. 



- 17- 

PA6E 22/31 * RCVD AT 12/12/2005 6:16:28 PM [Eastern Standard Time] ' SVR:USPTO-EFXRF-6/30 * DNIS:2738300 * CSID:4089714660 * DURATION (mm-ss):05-56 



DEC. 1 2. 2005 3:30PM Z I LKA-KOT AB, PC 



NO. 1271 P. 23 



4. (Original) The method as recited in claim 1, wherein the scanning control logic includes 
hardware. 

5. (Original) The method as recited in claim 3, wherein the scanning control logic is stored 
on the scanning co-processor. 

6. (Original) The method as recited in claim 1, wherein the scanning control logic includes 
software. 

7. (Original) The method as recited in claim 6, wherein the scanning control logic is stored 
in memory. 

8. (Original) The method as recited in claim 1 , wherein the event is initiated under the 
control of the scanning control logic. 

9. (Original) The method as recited in claim 1, wherein the scanning co-processor performs 
content scanning. 

10. (Original) The method as recited in claim 1, wherein the scanning co-processor performs 
virus scanning. 

1 1 . (Original) The method as recited in claim 1 , wherein the scanning co-processor includes 
memory. 

12. (Original) The method as recited in claim 1 1 , wherein virus signatures are stored in the 
memory, 

13. (Original) The method as recited in claim 1 1, wherein rule sets are stored in the memory. 

14. (Cancelled) 
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15. (Cancelled) 

16. (Cancelled) 

17. (Previously Presented) A computer program product for scanning data, comprising: 

a) computer code for executing scanning control logic utilizing a central processing unit; 

b) computer code for identifying a request related to data at the central processing unit; 

c) computer code for indicating the data to a scanning co-processor coupled to the central 
processing unit so that the data is scanned by the scanning co-processor under the control 
of the scanning control logic; 

d) computer code for waiting for results from the scanning co-processor; 

e) computer code for executing additional logic utilizing the central processing unit while 
waiting for the results from the scanning co-processor; and 

f) computer code for initiating an event based on the results from the scanning co- 
processor; 

wherein the scanning co-processor is under the control of the central processing unit via 
the execution of the scanning control logic by the central processing unit; 
wherein it is determined whether the data meets a predetermined criteria, where the 
criteria is based on a type of a file associated with the data; 

wherein the data is sent to the scanning co-processor if it is determined that the data 
meets the predetermined criteria; 

wherein additional data to be scanned by the scanning co-processor is queued while 
waiting for the results from the scanning co-processor. 

18. (Previously Presented) The computer program product as recited in claim 17, and further 
comprising computer code for processing the data utilizing the central processing unit 
upon the receipt of favorable results from the scanning co-processor including a situation 
where malicious code is not detected. 
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19. (Original) The computer program product as recited in claim 1 7, wherein the central 
processing unit is coupled to the scanning co-processor via a bus. 

20. (Original) The computer program product as recited in claim 17, wherein the scanning 
control logic includes hardware. 

21. (Original) The computer program product as recited in claim 20, wherein the scanning 
control logic is stored on the scanning co-processor. 

22. (Original) The computer program product as recited in claim 17, wherein the scanning 
control logic includes software. 

23. (Original) The computer program product as recited in claim 22, wherein the scanning 
control logic is stored in memory. 

24. (Original) The computer program product as recited in claim 17 3 wherein the event is 
initiated under the control of the scanning control logic. 

25. (Original) The computer program product as recited in claim 17, wherein the scanning 
co-processor performs content scanning. 

26. (Original) The computer program product as recited in claim 17, wherein the scanning 
co-processor performs vims scanning. 

27. (Original) The computer program product as recited in claim 17, wherein the scanning 
co-processor includes memory. 

28. (Original) The computer program product as recited in claim 27, wherein virus signatures 
are stored in the memory. 
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29. (Original) The computer program product as recited in claim 27, wherein rule sets are 
stored in the memory. 

30. (Cancelled) 

31. (Cancelled) 

32. (Cancelled) 

33. (Previously Presented) A system for scanning data, comprising: 

a) logic for executing scanning control logic utilizing a central processing unit; 

b) logic for identifying a request related to data at the central processing unit; 

c) logic for indicating the data to a scanning co-processor coupled to the central processing 
unit so that the data is scanned by the scanning co-processor under the control of the 
scanning control logic; 

d) logic for waiting for results from the scanning co-processor; 

e) logic for executing additional logic utilizing the central processing unit while waiting for 
the results from the scanning co-processor; and 

£) logic for initiating an event based on the results from the scanning co-processor; 

wherein the scanning co-processor is under the control of the central processing unit via 
the execution of the scanning control logic by the central processing unit; 
wherein it is determined whether the data meets a predetermined criteria, where the 
criteria is based on a type of a file associated with the data; 

wherein the data is sent to the scanning co-processor if it is determined that the data 
meets the predetermined criteria; 

wherein additional data to be scanned by the scanning co-processor is queued while 
waiting for the results from the scanning co-piocessor. 

34. (Previously Presented) A method for scanning data, comprising: 

a) executing scanning control logic utilizing a central processing unit; 

b) identifying a request related to data at the central processing unit; 
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c) determining whether the data meets a predetermined criteria utilizing the central 
processing unit under the control of the scanning control logic; 

d) indicating the data to a scanning co-processor coupled to the central processing unit if it 
is determined that the data meets the predetermined criteria; 

e) collecting scanning information from memory on the scanning co-processor; 

f) scanning the data with the scanning co-processor utilizing the scanning information under 
the control of the scanning control logic; 

g) waiting for results from the scanning co-processor, 

h) executing additional logic utilizing the central processing unit while waiting for the 
results from the scanning co-processor; 

i) queuing additional data to be scanned by the scanning co-processor while waiting for the 
results from the scanning co-processor, 

j) initiating a security event upon the receipt of unfavorable results from the scanning co- 
processor including a situation where malicious code is detected; and 

k) processing the data utilizing the central processing unit upon the receipt of favorable 

results from the scanning co-processor including a situation where malicious code is not 
detected; 

wherein the scanning co-processor is under the control of the central processing unit via 
the execution of the scanning control logic by the central processing unit; 
wherein the criteria is based on a type of a file associated with the data, 

35. (Previously Presented) A system for scanning data, comprising: 

a) means for executing scanning control logic utilizing a central processing unit; 

b) means for identifying a request related to data at the central processing unit; 

c) means for determining whether the data meets a predetermined criteria utilizing the 
central processing unit under the control of the scanning control logic; 

d) means for indicating the data to a scanning co-processor coupled to the central processing 
unit if it is determined that the data meets the predetermined criteria; 

e) means for collecting scanning information from memory on the scanning co-processor; 

f) means for scanning the data with the scanning co-processor utilizing the scanning 
information under the control of the scanning control logic; 
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g) means for waiting for results from the scanning co-processor; 

h) means for executing additional logic utilizing the central processing unit while waiting 
for the results from the scanning co-processor; 

i) means for queuing additional data to be scanned by the scanning co-processor while 
waiting for the results from the scanning co-processor; 

j) means for initiating a security event upon the receipt of unfavorable results from the 
scanning co-processor including a situation where malicious code is detected; and 

k) means for processing the data utilizing the central processing unit upon the receipt of 
favorable results from the scanning co-processor including a situation where malicious 
code is not detected; 

wherein the scanning co-processor is under the control of the central processing unit via 
the execution of (he scanning control logic by the central processing unit; 
wherein the criteria is based on a type of a file associated with the data. 

36. (Original) The system as recited in claim 35, wherein the scanning information is updated 
via a network periodically. 

37. (Original) The system as recited in claim 35, wherein the additional logic to be executed 
and the additional data queued to be scanned are handled utilizing multi-threading 
algorithms. 

38. (Previously Presented) The method as recited in claim 1 , wherein the criteria is further 
based on a user, 

39. (Previously Presented) The method as recited in claim 1, wherein the criteria is further 
based on software logic run by a bios. 

40. (Previously Presented) The method as recited in claim 1, wherein the scanning control 
logic is executed automatically. 
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41 . (Previously Presented) The method as recited in claim 1, wherein the scanning control 
logic is executed automatically when a computer is booted up. 

42. (Previously Presented) The method as recited in claim 1, wherein the scanning control 
logic is executed manually by a user. 

43. (Previously Presented) The method as recited in claim 1, wherein the scanning control 
logic is executed using software logic run by a bios. 

44. (Previously Presented) The method as recited in claim 1, wherein the central processing 
unit aids the scanning co-processor when a large amount of data is to be scanned. 
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IX APPENDIX LISTING ANY EVIDENCE RELIED ON BY THE APPELLANT IN THE 
APPEAL (37 C.F.R. § 41 37(c)(l)(ix)) 

There is no such evidence. 
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In the event a telephone conversation would expedite the prosecution of this application, 
the Examiner may reach the undersigned at (408) 971-2573. For payment of any additional fees 
due in connection with the filing of this paper, the Commissioner is authorized to charge such 
fees to Deposit Account No. 50-1351 (Order No. NAI1P014/01. 128.01). 




Zilka-Kotab, P.C. 

P.O. Box 721120 

San Jose, California 95172-1 120 

Telephone: (408) 971-2573 

Facsimile: (408)971-4660 
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